HackingRetail & ConsumerRetailStolen CredentialsCustomer Data InvolvedIdentity (basic)Government IDHighContained

Delaware North Companies, Incorporated

bd_15c79f9522f2a3e1 · schema v1 · pii pii-v1

Severity

High

Discovered

Jan 28, 2026

Filed

Jun 8, 2026

To disclose

19 weeks

Affected

9,706state residents only

Linked

7 filings

Confidence

66%

Full breach record for Delaware North Companies, Incorporated →2 incidents on file

Delaware North notified South Carolina residents of a cybersecurity incident detected on January 28, 2026, involving unauthorized access to an employee's Microsoft account. The actor copied files containing names and driver's license or state ID numbers. Delaware North secured the account, engaged Kroll for credit monitoring services, and issued notices to affected individuals across multiple states.

J jump to incidentP pin to compareR raw source

South Carolina clock✓ SC CRA notice due19 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

discovery → filing · 19 weeks / 131 days

Jan 28, 2026

Discovered

Jun 8, 2026

Filed

vs. sector median

+11 wks slower

This filing is one of 7 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

Texas State AGbd_9de19706abf8c87f2026-06-09 · +1dVerified
Vermont State AGbd_13e59bf75513616a2026-06-05 · +3dVerified
Maine State AGbd_5613a4ab0413a8e62026-06-05 · +3dVerified
New Hampshire State AGbd_8cee35d178d2800d2026-06-05 · +3dVerified

Show 2 more filings ↓up to 3d gap

Indiana State AGbd_af44af7a447137942026-06-05 · +3dVerified
Massachusetts State AGbd_c674e9b48e605fc82026-06-05 · +3dCandidate

Name: Delaware North Companies, Incorporated
norm: delaware north companies

Name: Delaware North Companies, Incorporated
norm: delaware north companies
Industry: Retail & Consumerllm

Discovered: Jan 28, 2026
Materiality determined: —
Notification sent: —
Affected individuals: 9,706state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Initial access: valid_credentials

During the incident: Secured the employee's Microsoft account
Began an investigation
Engaged Kroll to provide credit and identity monitoring services
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 19 weeks(131 days from discovery to filing)
Compliance flags: SC CRA notice due
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 7 states

View merged incident ↗

Vermont State AGJun 5 · first

Maine State AGJun 5 · first

New Hampshire State AGJun 5 · first

Indiana State AGJun 5 · first

Massachusetts State AGJun 5 · first

South Carolina State AG+3d · this page

Texas State AG+4d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-%20Delaware%20North.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 8, 2026
Raw hash: 3e2d3bfbd0914a783960768626ef600f32ff83e979cb795591ce26b32cbc62d2

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityDelaware North Companies, Incorporated

Victim entityDelaware North Companies, Incorporated

Incidentdiscovered Jan 28, 2026

Stated responseSecured the employee's Microsoft account

ComplianceSC CRA notice due

Extraction provenanceno artifact recorded

Source provenanceconsumer.sc.gov